PT-2020-3786 · Squid+7 · Squid+8
Régis Leroy
·
Published
2020-08-24
·
Updated
2024-06-15
·
CVE-2020-15811
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions:
Squid versions prior to 4.13
Squid versions 5.x prior to 5.0.4
Description:
An issue was discovered due to incorrect data validation, allowing HTTP Request Splitting attacks to succeed against HTTP and HTTPS traffic. This leads to cache poisoning, enabling any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. The issue arises because Squid uses a string search instead of parsing the
Transfer-Encoding header to find chunked encoding, allowing an attacker to hide a second request inside Transfer-Encoding. This is interpreted by Squid as chunked and split out into a second request delivered upstream, resulting in Squid delivering two distinct responses to the client and corrupting any downstream caches. The vulnerability is also related to the lack of processing of CRLF sequences in HTTP headers.Recommendations:
For Squid versions prior to 4.13, update to version 4.13 or later.
For Squid versions 5.x prior to 5.0.4, update to version 5.0.4 or later.
As a temporary workaround, consider restricting access to the
Transfer-Encoding header to minimize the risk of exploitation.Fix
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Linuxmint
Red Hat
Rocky Linux
Squid
Squid Cache
Suse
Ubuntu